PHP releases 8.2.35 to fix two critical flaws that could allow remote code execution

The PHP development team has released PHP 8.2.35, a security update that fixes two critical vulnerabilities. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. According to the project, they can allow unauthenticated remote code execution, which means an attacker could run commands on a server without logging in.

The PHP team strongly encourages all PHP 8.2 users to update immediately. It says there are no complete mitigations, so updating is the only safe choice. The full details are in the PHP security advisory.

PHP is a widely used scripting language for building websites. It runs on a web server, talks to databases, handles the backend logic of an application and then sends the finished page to the user's browser. It is also used inside a range of other products.

The UK's National Cyber Security Centre (NCSC) has also issued an alert. It says an attacker could trigger an out-of-memory condition in PHP, which leads to memory corruption. Under certain conditions, that corruption could be exploited to achieve remote code execution. The NCSC says the issue has now been fixed.

The two flaws work in different ways, based on the descriptions in the NCSC alert. CVE-2026-109618 involves out-of-memory handling that can interrupt PHP while internal request data is only partly set up. Request cleanup may then treat that invalid data as valid.

CVE-2026-109619 involves internal state that belongs to a request but survives after the memory behind it has been freed. A later request handled by the same worker may use that stale state before normal initialisation resets it.

The NCSC says organisations using any version of PHP are affected. It urges them to update to the latest fixed version. Those on older versions should move to a fully supported one.

The NCSC's advice starts with finding out where PHP runs. Organisations should identify PHP systems across their infrastructure, putting internet-facing ones first. It says not to limit the search to outdated versions, because all versions may be affected. Appliances and services that bundle PHP as a component should be checked too.

After that, update to the latest PHP version and apply the extra hardening steps from the PHP team. If an update is not possible, the PHP team has provided temporary mitigations. If those cannot be applied, or would take too long, the NCSC says to consider taking the system offline until it is fully fixed.

If a system cannot be updated or disabled right away, the NCSC advises checking it for signs of compromise, including backdoors left by an attacker. Organisations that are not confident doing this themselves can get help from an NCSC-assured Cyber Incident Response provider. The Dutch agency NCSC-NL has published a list of software products with a PHP dependency that may be affected.

There is also a longer-term deadline. PHP 8.2 reaches end of life on 31 December 2026 and will get no further security fixes after that. The PHP team asks users to plan an upgrade to a supported version.

The NCSC says it will keep monitoring for any impact on UK organisations.